Vulnerabilities in apostrophecms
56 resultsCVE-2026-113667MEDIUMApostropheCMS: CAPTCHA response token not URL-encodedEPSS 0.4%CVE-2026-33877LOWApostropheCMS: User Enumeration via Timing Side Channel in Password Reset EndpointEPSS 0.4%CVE-2026-113660MEDIUMApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft IdentifiersEPSS 0.4%CVE-2026-113665LOWApostropheCMS: Missing Authorization on Notification PATCH/DELETE EndpointsEPSS 0.3%CVE-2026-53609CRITICALApostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypassEPSS 0.3%CVE-2026-113659MEDIUMApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated usersEPSS 0.3%CVE-2026-112956MEDIUMApostropheCMS: Archive duplicate continuation lets contributors overwrite published contentEPSS 0.3%CVE-2026-112952MEDIUMApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated userEPSS 0.3%CVE-2026-113710MEDIUMApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password GuessingEPSS 0.3%CVE-2026-113671MEDIUMApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRFEPSS 0.3%CVE-2026-113648LOWApostropheCMS: Missing Authentication in `cleanExport` RouteEPSS 0.3%CVE-2026-113651LOWApostropheCMS: Path traversal in uploadfsEPSS 0.3%CVE-2026-63670MEDIUMApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus closeEPSS 0.3%CVE-2026-113655MEDIUMApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorizationEPSS 0.3%CVE-2026-113668MEDIUMApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)EPSS 0.3%CVE-2026-113657LOWApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)EPSS 0.3%CVE-2026-63669MEDIUMApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtreeEPSS 0.3%CVE-2026-112957MEDIUMApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged usersEPSS 0.3%CVE-2026-45013HIGHApostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input ValidationEPSS 0.3%CVE-2026-112951MEDIUMApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixEPSS 0.3%